Security News pnpm 9.5 Introduces Catalogs: Shareable Dependency Version Specifiers pnpm 9.5 introduces a Catalogs feature, enabling shareable dependency version specifiers, reducing merge conflicts and improving support for monorepos. pnpm is eight years into its unique approach to package management, and continues to gain traction, especially among those who need efficiency and support for monor

Security News ESLint Approves RFC to Add Support for TypeScript Config Files ESLint has approved an RFC that adds support for TypeScript configuration files, which is aimed at improving the developer experience and recognizing changes in the evolving JavaScript ecosystem. ESLint, a widely used tool for identifying and reporting on patterns found in ECMAScript/JavaScript code, has approved an RFC (

Secure your dependencies. Ship with confidence.Socket is a developer-first security platform that protects your code from both vulnerable and malicious dependencies.

Security News JSR: What We Know So Far About Deno’s New JavaScript Package Registry JSR, a new package registry from the Deno team, aims to address npm’s limitations but the JavaScript community is concerned about ecosystem fragmentation. The JavaScript community is buzzing about JSR, a new package registry from the team behind Deno, a runtime for JavaScript, TypeScript, and WebAssembly based on t

Security News Express.js Spam PRs Incident Highlights the Commoditization of Open Source Contributions A mountain of spam PRs landed in the Express.js project repo after a popular YouTube tutorial used it as an example for contributing to open source. This put a spotlight on the mandate for job seekers to find a way to contribute to OSS. A tidal wave of spam pull requests recently hit the popular

Research npm in Review: A 2023 Retrospective on Growth, Security, and Quirky Facts From unprecedented expansion to security challenges: A comprehensive look at npm's dynamic year 2024. It's a new year! So let's look back at how npm, the most popular package manager in the world, fared in 2023. We will look at some of the major trends in the ecosystem and investigate what the data reveal about how

Product Introducing "safe npm", a Socket npm Wrapper Socket is proud to introduce an exciting new tool—“safe npm”—that protects developers whenever they use npm install. Socket is proud to introduce an exciting new tool—“safe npm”—that protects developers whenever they use npm install. Socket’s “safe npm” CLI tool transparently wraps the npm command and protects developers from malware, typosquats